Remote Network Monitoring Management Information Base Version 2
obsoletes
- rfc-2021 — Remote Network Monitoring Management Information Base Version 2 using SMIv2
updates
- rfc-3273 — Remote Network Monitoring Management Information Base for High Capacity Networks
Extracted elements (30)
Packets with link-level errors are not counted anywhere in RMON2 because decoding packet contents is meaningless if there is a link-level error. Packets with protocol errors are counted for all protocols below the error layer, so transport-layer errors still yield valid network-layer statistics.
Protocol directory 'limited extensibility' allows table-driven decoding to extend one layer above what static code supports (e.g., recognizing new UDP port numbers as distinct protocols) without arbitrary protocol parsing. This is explicitly limited to one additional level to reflect the static nature of probe software.
Several objects deprecated in this revision (probeDownloadFile, serialMode, netConfigIPAddress, trapDestIndex, and Token Ring augmentation objects) had insufficient independent implementations to demonstrate interoperability required for Draft Standard advancement.
The OwnerString mechanism on each control entry allows multiple management stations to share probe resources by identifying who owns each function. The convention that 'monitor'-prefixed owner strings indicate long-lived administrator-configured entries discourages indiscriminate modification by management stations.
The TimeFilter mechanism was introduced to allow management applications to retrieve only changed rows since their last poll, avoiding full table downloads. Agents are encouraged (but not required) to optimize MIB walks by skipping rows with a TimeFilter index higher than the GetNext/GetBulk request value, preventing walk storms in large tables.
Management applications must be able to handle both the optimized TimeFilter implementation (only one pass through the table per walk) and the traditional implementation (every conceptual time-filtered instance returned). Agents may implement either approach.
RMON2 probes that also implement RMON may use the augmented filter and capture status bits (bits 6-9) for WAN direction, physical-layer errors, too-short, and too-long packets. These enhancements add no requirements to RMON-only compliant probes.
Some combinations of protocolDirID and protocolDirParameters index values may result in an SNMP OID exceeding 128 sub-identifiers, which exceeds the SNMP protocol maximum. Implementations must take care to avoid such combinations when constructing table indexes.
A protocolDirLocalIndex must not be re-used until the next agent restart in the event that the protocol directory entry is deleted, ensuring management applications can detect deletions and re-creations.
An agent must allow a row to be created with any unused index value if it has the resources; index values may be any valid value in the range and are chosen by the manager. When more than one manager simultaneously attempts to create the same conceptual row, only the first will succeed.
If a remote monitoring device implements a group, it must implement all objects in that group. For example, a managed agent that implements the network layer matrix group must implement both nlMatrixSDTable and nlMatrixDSTable.
If protocolDirAddressMapConfig is notSupported(1), the probe shall not allow this object to be changed to any other value. When this value changes from supportedOn(3) to supportedOff(2), the probe shall delete all related entries in the addressMapTable.
If protocolDirStatus is not equal to active(1), all associated entries in the nlHostTable, nlMatrixSDTable, nlMatrixDSTable, alHostTable, alMatrixSDTable, and alMatrixDSTable shall be deleted.
Implementations of the RMON2 MIB must also implement the IF-MIB (RFC 2863), which provides the ifIndex objects referenced by DataSource and addressMapSource.
The protocolDirLocalIndex value for each supported protocol must remain constant from one re-initialization of the network management system to the next, except that a deleted and re-created protocol must receive a new value not previously used since last re-initialization.
When an entry is written to protocolDirTable with a protocolDirID that the agent doesn't understand either directly or algorithmically, the SET request will be rejected with an inconsistentName or badValue (for SNMPv1) error.
When protocolDirHostConfig changes from supportedOn(3) to supportedOff(2), the probe shall delete all related entries in the nlHostTable and alHostTable. Similarly, changes in protocolDirMatrixConfig shall trigger deletion of related matrix table entries.
The addressMapTable stores mappings from network-layer address to physical address to interface, indexed by TimeFilter, protocolDirLocalIndex, addressMapNetworkAddress, and addressMapSource. The probe populates this for all protocols with protocolDirAddressMapConfig set to supportedOn(3).
The DataSource textual convention (SYNTAX OBJECT IDENTIFIER) identifies the interface a monitoring function analyzes by pointing to an instance of ifIndex from IF-MIB. For example, to receive data from interface #1, this is set to ifIndex.1.
The hlHostControlTable controls collection of network-layer (nlHostTable) and application-layer (alHostTable) host statistics per interface. It includes DroppedFrames counters and insert/delete counters for both tables, with configurable maximum desired entries (-1 means unlimited).
The LastCreateTime textual convention (SYNTAX TimeTicks) stores the value of sysUpTime when an entry was last created, enabling management applications to detect that an entry was deleted and re-created between polls.
The protocolDirTable lists protocols the agent can decode and count, indexed by protocolDirID (OCTET STRING 4..128) and protocolDirParameters (OCTET STRING 1..32). It supports limited extensibility, allowing child protocol entries to be added via SNMP for protocols whose parent has the 'extensible' bit set.
The protocolDistStatsTable provides per-interface, per-protocol packet and octet counts (ZeroBasedCounter32), indexed by protocolDistControlIndex and protocolDirLocalIndex. Counters are updated for every protocol encountered when parsing a packet but not for MAC-layer error frames.
The TimeFilter textual convention (SYNTAX TimeTicks) is used as the first INDEX component in time-filtered tables. An agent returns a conceptual entry only if any column within it has changed since the sysUpTime value given as the TimeFilter index, enabling incremental polling.
The ZeroBasedCounter32 textual convention describes a Gauge32 that resets to zero on creation and wraps at 2^32. It is used in tables where the INDEX space changes frequently or the TimeFilter mechanism is in use, enabling delta calculations from the initial value.
Section 7 addresses the security of SNMP access to RMON2 MIB objects. Several objects have read-write or read-create access and are sensitive because they control the probe's monitoring functions; unauthorized modification could disrupt network management data collection. SNMPv3 security mechanisms are recommended to control access.
Control table entries use the RowStatus textual convention with states notInService/active. Parameters that describe resulting data may only be modified when the entry is not active; the standard lifecycle is: deactivate, modify, reactivate. Deleting the control entry cascades to delete all associated data entries.
addressMapNetworkAddress is an OCTET STRING (SIZE 1..255) encoded as a length octet followed by the address bytes in network byte order. For IP, this is a length octet of 4 followed by the 4-octet IP address.
protocolDirID is an OCTET STRING (SIZE 4..128) encoding a hierarchical protocol identifier as a sequence of 4-octet sub-identifiers. The index also includes a length sub-identifier prefix; for example, protocolDirLocalIndex.8.0.0.0.1.0.0.8.0.2.0.0 encodes a length of 8 followed by 8 subids.
protocolDirParameters is an OCTET STRING (SIZE 1..32) with one octet per sub-identifier in the corresponding protocolDirID, in the same order. Each node in the protocolDirID tree has an optional parameter definition; if no parameters are defined for a node, its parameter field is zero.